---
title: OWASP Top 10 - A10 Unvalidated Redirects and Forwards
description: "Description\nIf a user is redirected or forwarded to a page defined by an unverified entry,\nthe target URL can be manipulated by an attacker.\nThis attack is used to redirect a user to a malicious website through a website\nwith a trusted domain name (phishing) or to access an"
image: https://blog.ippon.tech/hubfs/Imported_Blog_Media/ippon-bkr-Jan-18-2024-06-11-24-2135-PM.png
---
[Skip to main content](https://blog.ippon.tech/owasp-top-10-a10#main)
[   ](https://ipponusa.com/)
- [Home](https://ipponusa.com)
- [Show submenu for About About](https://ipponusa.com/about-us)
- [Who We Are](https://ipponusa.com/who-we-are)
- [Careers](https://ipponusa.com/careers)
- [Show submenu for Our Partners Our Partners](https://ipponusa.com/our-partners/)
- [AWS](https://ipponusa.com/our-partners/aws/)
- [Snowflake](https://ipponusa.com/our-partners/snowflake/)
- [Databricks](https://ipponusa.com/our-partners/databricks/)
- [Microsoft](https://ipponusa.com/our-partners/microsoft/)
- [Show submenu for Services Services](https://ipponusa.com/services)
- [Snowflake](https://ipponusa.com/service/snowflake-concierge/)
- [Artificial Intelligence](https://ipponusa.com/service/artificial-intelligence/)
- [Data & Analytics](https://ipponusa.com/service/data-analytics/)
- [Cloud Strategy](https://ipponusa.com/service/cloud-strategy/)
- [Platform Modernization](https://ipponusa.com/service/platform-moderization/)
- [Product Innovation](https://ipponusa.com/service/product-innovation/)
- [Operating Model](https://ipponusa.com/service/operating-model/)
- [Blogs](https://blog.ippon.tech/)
- [Success Stories](https://ipponusa.com/success-stories/)
- [Show submenu for Resources Resources](https://ipponusa.com/resources/)
- [eBooks](https://ipponusa.com/ebooks/)
- [The Data Pour](https://info.ippon.tech/the-data-pour)
- [Videos & Webinars](https://info.ippon.tech/videos-and-webinars)
- [Media Center](https://ipponusa.com/media-center/)
Search
Open main navigation
Close main navigation
- [Home](https://ipponusa.com)
- Show submenu for About About
- About
- [About](https://ipponusa.com/about-us)
- [Who We Are](https://ipponusa.com/who-we-are)
- [Careers](https://ipponusa.com/careers)
- Show submenu for Our Partners Our Partners
- Our Partners
- [Our Partners](https://ipponusa.com/our-partners/)
- [AWS](https://ipponusa.com/our-partners/aws/)
- [Snowflake](https://ipponusa.com/our-partners/snowflake/)
- [Databricks](https://ipponusa.com/our-partners/databricks/)
- [Microsoft](https://ipponusa.com/our-partners/microsoft/)
- Show submenu for Services Services
- Services
- [Services](https://ipponusa.com/services)
- [Snowflake](https://ipponusa.com/service/snowflake-concierge/)
- [Artificial Intelligence](https://ipponusa.com/service/artificial-intelligence/)
- [Data & Analytics](https://ipponusa.com/service/data-analytics/)
- [Cloud Strategy](https://ipponusa.com/service/cloud-strategy/)
- [Platform Modernization](https://ipponusa.com/service/platform-moderization/)
- [Product Innovation](https://ipponusa.com/service/product-innovation/)
- [Operating Model](https://ipponusa.com/service/operating-model/)
- [Blogs](https://blog.ippon.tech/)
- [Success Stories](https://ipponusa.com/success-stories/)
- Show submenu for Resources Resources
- Resources
- [Resources](https://ipponusa.com/resources/)
- [eBooks](https://ipponusa.com/ebooks/)
- [The Data Pour](https://info.ippon.tech/the-data-pour)
- [Videos & Webinars](https://info.ippon.tech/videos-and-webinars)
- [Media Center](https://ipponusa.com/media-center/)
- Search
- [Contact Us](https://ipponusa.com/contact/)
[Contact Us](https://ipponusa.com/contact/)
# OWASP Top 10 - A10 Unvalidated Redirects and Forwards
by [Philippe Cery](https://blog.ippon.tech/author/philippe-cery)
January 29, 2014
[OWASP](https://blog.ippon.tech/tag/owasp/) [Security](https://blog.ippon.tech/tag/security/) [Web](https://blog.ippon.tech/tag/web/)
[Philippe Cery](https://blog.ippon.tech/author/philippe/) Jan 29, 2014
## Description
If a user is redirected or forwarded to a page defined by an unverified entry, the target URL can be manipulated by an attacker.
This attack is used to redirect a user to a malicious website through a website with a trusted domain name (phishing) or to access an unauthorized internal page.
## Examples
My bank provides a very interesting page “My favorites” to easily access all available services and manage my own favorites. Thanks to this page, I can retrieve all my favourites from any computer, everywhere in the world.
For example, when I want to consult my emails, I click on “My mailbox” I have added in that page. The URL `https://www.mybank.com/redirect.jsp?url=www.mymailbox.com` is called then I am redirected to `http://www.mymailbox.com/`.
Last time I’ve checked my mailbox, I have received an email from my bank to confirm my login and passcode for security reasons. I click on the provided link, enter my login and passcode and that’s it!
The problem is the link I have clicked on was `https://www.mybank.com/redirect.jsp?url=www.trustme.com` and I was silently redirected to `http://www.trustme.com/` on a page with the look-and-feel of my bank’s website.
A few days later, I received a call from my bank. Someone has used my personal credentials to access my accounts and sent my money abroad.
## Mitigations
It is very simple to mitigate this risk: never redirect or forward to unverified URLs or URLs modifiable with user entry.
An unverified URL is an URL entered by the user and not verified/trusted by the server.
A modifiable URL is a URL with parts (domain name, path, parameters…) that can be modified with unverified/untrusted values entered by user.
In both cases, the URL can be a full URL (for redirections) or a path to an internal resource (for forwards).
If you really need to redirect a user to another page (external or internal) registered by that user, the page URL must not be in a request parameter. Use an indirect reference instead. Refer to one of my previous posts about [Insecure Direct Object References](https://blog.ippon.tech/owasp-top-10-a4/) for details on generating an indirect object reference.
E.g. use `https://www.mybank.com/redirect.jsp?urlId=abc321` instead of `https://www.mybank.com/redirect.jsp?url=www.mymailbox.com`, where `urlId` is an indirect reference to the URL `http://www.mymailbox.com` added in user’s favorites.
Besides, you can also check the URL is well-formed and can be trusted before storing it in your database. Some commercial antivirus/firewall products and online services provide blacklist of suspicious websites that can’t be trusted.
If the user can choose a landing page after some actions (e.g. its default homepage after login), instead of giving him a blank field to enter what he wants, propose a list of acceptable landing pages. This way, the user won’t be tempted to enter something like `/secure/mgmt/users.xhtml` to access user management without authorization! Obviously, if you have applied what I have said in my post about [Missing Function Level Access Control](https://blog.ippon.tech/owasp-top-10-a7/), this attempt should not work 😉
And again, remember you must avoid direct references. Don’t give the real path to the internal resource in the list!
To see all articles related to OWASP Top 10, follow the tag [#owasp](https://blog.ippon.tech/tag/owasp/)
## Related Articles
##### [ OWASP • July 17, 2014 Security White Paper: OWASP - Building Secure Web Applications 0 min read](https://blog.ippon.tech/webapp-security-white-paper)
##### [ OWASP • January 28, 2014 OWASP Top 10 - A9 Using Components with Known Vulnerabilities 3 min read](https://blog.ippon.tech/owasp-top-10-a9)
### Comments
### Subscribe to Our Blog!
Stay informed with the latest insights and updates by signing up for our weekly blog newsletter – delivered straight to your inbox!
[Back to blog homepage »](https://blog.ippon.tech/)
Ippon is a consulting and expertise firm, who is convinced that technology is a source of progress for society. We help our clients leverage their digital assets to design an appropriate strategy and deploy their transformation roadmap at scale.
#### Navigation
- [Home](https://ipponusa.com/)
- [About](https://ipponusa.com/about-us/)
- [Services](https://ipponusa.com/services/)
- [Blogs](https://blog.ippon.tech/?__hstc=223043268.1036d82247623b329dfefe4e92697801.1714729179243.1714729179243.1714729179243.1&__hssc=223043268.2.1714729179244&__hsfp=803678701)
- [eBooks](https://ipponusa.com/ebooks/)
- [The Data Pour](https://info.ippon.tech/the-data-pour?__hstc=223043268.1036d82247623b329dfefe4e92697801.1714729179243.1714729179243.1714729179243.1&__hssc=223043268.2.1714729179244&__hsfp=803678701)
[Contact Us](https://ipponusa.com/contact/)
[Join Us](https://ipponusa.com/careers/)
#### Services
- [Data & Analytics](https://ipponusa.com/service/data-analytics/)
- [Cloud Strategy](https://ipponusa.com/service/cloud-strategy/)
- [Artificial Intelligence](https://ipponusa.com/service/artificial-intelligence/)
- [Operating Model](https://ipponusa.com/service/operating-model/)
- [Platform Modernization](https://ipponusa.com/service/platform-moderization/)
- [Product Innovation](https://ipponusa.com/service/product-innovation/)
#### Ippon International
- [France](https://fr.ippon.tech/?__hstc=223043268.1036d82247623b329dfefe4e92697801.1714729179243.1714729179243.1714729179243.1&__hssc=223043268.2.1714729179244&__hsfp=803678701)
- [Australia](https://au.ippon.tech/?__hstc=223043268.1036d82247623b329dfefe4e92697801.1714729179243.1714729179243.1714729179243.1&__hssc=223043268.2.1714729179244&__hsfp=803678701)
- #### Contact
- Ippon Technologies
[3431 West Leigh Street Richmond, VA 23230, USA](https://maps.app.goo.gl/RySm6SAwZnsxeiLz9)
- [(844) 477- 6687](tel:8444776687)
- [Sales@ipponusa.com](mailto:Sales@ipponusa.com)
©Copyright 2024 Ippon USA. All Rights Reserved. | [Terms and Conditions](https://ipponusa.com/privacy-policy/) | [Privacy Policy](https://ipponusa.com/privacy-policy/) | [Website by Skol Marketing](https://skolmarketing.com/)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Philippe Cery",
"url" : "https://blog.ippon.tech/author/philippe-cery"
},
"dateModified" : "2024-01-25T17:51:47.857Z",
"datePublished" : "2014-01-29T17:51:00.000Z",
"headline" : "OWASP Top 10 - A10 Unvalidated Redirects and Forwards",
"image" : [ "https://blog.ippon.tech/hubfs/Imported_Blog_Media/ippon-bkr-Jan-18-2024-06-11-24-2135-PM.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.ippon.tech/owasp-top-10-a10",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.ippon.tech/hubfs/logo_SVG.svg"
},
"name" : "Ippon Technologies"
}
}
```